FYI for anyone else running PHP in production.
https://x.com/ThePHPF/status/2112633155631108544?s=20
X (formerly Twitter)The PHP Foundation (@ThePHPF) on XThe PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
commit 60fd877